(CNN) -- Rapper T.I. walked out of a federal prison in Arkansas Wednesday morning, 10 months after he began serving a sentence for violating his parole on a gun conviction, a prison official confirmed.

"The storm is over & da sun back out. IT'S OUR TIME TO SHINE SHAWTY!!!!! Welcome to the beginning of our Happy Ending!!!!" T.I., whose real name is Clifford Harris, wrote in a Twitter message Wednesday.

T.I. will complete the last weeks of his 11-month sentence in a community service sentence, or half-way house, but Bureau of Prisons spokesman Chris Burke would not disclose its location until he gets there.

This was the rapper's second stint in the Federal Correctional Center in Forrest City, Arkansas. He served seven months there in 2009 as part of an unusual sentence negotiated two years ago to resolve federal gun charges. Those charges followed his attempt to buy three machine guns in the parking lot of an Atlanta grocery store.

"Feels great to be back where I belong...Back in the arms of those who need me the most," T.I. tweeted Wednesday.

His latest prison time was triggered by his arrest, along with his wife, when a motorcycle officer stopped their car on Sunset Boulevard in Beverly Hills, California a year ago.

A police report said suspected drugs were found in the couple's car and they were both arrested on drug charges. While the charge against Harris was later dropped, he failed a drug test given by his parole officer.

The cornerstone of the plea deal was his community service which included the rapper speaking to young people about the importance of staying off drugs and out of trouble.

At a federal parole violations hearing a month his arrest, Harris acknowledged that he had a drug addition problem.

"I screwed up big time and I am sorry," Harris told U.S. District Judge Charles Pannell Jr. "I am sincerely sorry. I am scared that you will send me to prison."

"Mr. Harris has had the limit of second chances," Pannell said as he imposed the 11-month sentence last October.

"He was supposed to be living what he was preaching," U.S. Attorney Sally Yates said at the hearing.

Harris is an Atlanta-based rapper, music producer and actor. He is also the head of the Grand Hustle record label.

Monday, August 29, 2011

"An adult film performer has tested HIV positive, prompting a temporary shutdown Monday of adult film productions across Los Angeles until further testing can confirm the results, an industry trade group said.

“Until we know for sure, we’ve asked the industry to have a moratorium on production,” said Diane Duke, executive director of the Free Speech Coalition, a Canoga Park-based porn industry trade group.

Duke’s group became aware of the possible HIV case Saturday, according to a statement released to porn industry media. Duke would not say how her group learned about the possible HIV case.

She said she notified adult film production companies across the San Fernando Valley on Monday morning that a performer had tested positive and urged them to temporarily halt productions until further tests were completed.

Duke said company officials she spoke with -- including those at well-known studios, such as Hustler and Evil Angel -- agreed to the temporary shutdown.

Duke said she could not release the performer’s name, age or gender. Further testing will likely be completed within a week, she added.

Her group will notify performers who had sex with the potentially infected person so they can get tested".

Introduction / some important facts
===================================

tmbinc said it himself, software based approaches of running unsigned code on the 360 mostly don't work, it was designed to be secure from a software point of view.

The processor starts running code from ROM (1bl) , which then starts loading a RSA signed and RC4 crypted piece of code from NAND (CB).

CB then initialises the processor security engine, its task will be to do real time encryption and hash check of physical DRAM memory. From what we found, it's using AES128 for crypto and strong (Toeplitz ?) hashing. The crypto is different each boot because it is seeded at least from:
- A hash of the entire fuseset.
- The timebase counter value.
- A truly random value that comes from the hardware random number generator the processor embeds. on fats, that RNG could be electronically deactivated, but there's a check for "apparent randomness" (merely a count of 1 bits) in CB, it just waits for a seemingly proper random number.

CB can then run some kind of simple bytecode based software engine whose task will mainly be to initialise DRAM, CB can then load the next bootloader (CD) from NAND into it, and run it.

Basically, CD will load a base kernel from NAND, patch it and run it.

That kernel contains a small privileged piece of code (hypervisor), when the console runs, this is the only code that would have enough rights to run unsigned code.
In kernel versions 4532/4548, a critical flaw in it appeared, and all known 360 hacks needed to run one of those kernels and exploit that flaw to run unsigned code.
On current 360s, CD contains a hash of those 2 kernels and will stop the boot process if you try to load them.
The hypervisor is a relatively small piece of code to check for flaws and apparently no newer ones has any flaws that could allow running unsigned code.

On the other hand, tmbinc said the 360 wasn't designed to withstand certain hardware attacks such as the timing attack and "glitching".

Glitching here is basically the process of triggering processor bugs by electronical means.

This is the way we used to be able to run unsigned code.

The reset glitch in a few words
===============================

We found that by sending a tiny reset pulse to the processor while it is slowed down does not reset it but instead changes the way the code runs, it seems it's very efficient at making bootloaders memcmp functions always return "no differences". memcmp is often used to check the next bootloader SHA hash against a stored one, allowing it to run if they are the same. So we can put a bootloader that would fail hash check in NAND, glitch the previous one and that bootloader will run, allowing almost any code to run.

Details for the fat hack
========================

On fats, the bootloader we glitch is CB, so we can run the CD we want.

cjak found that by asserting the CPU_PLL_BYPASS signal, the CPU clock is slowed down a lot, there's a test point on the motherboard that's a fraction of CPU speed, it's 200Mhz when the dash runs, 66.6Mhz when the console boots, and 520Khz when that signal is asserted.

So it goes like that:
- We assert CPU_PLL_BYPASS around POST code 36 (hex).
- We wait for POST 39 start (POST 39 is the memcmp between stored hash and image hash), and start a counter.
- When that counter has reached a precise value (it's often around 62% of entire POST 39 length), we send a 100ns pulse on CPU_RESET.
- We wait some time and then we deassert CPU_PLL_BYPASS.
- The cpu speed goes back to normal, and with a bit of luck, instead of getting POST error AD, the boot process continues and CB runs our custom CD.

The NAND contains a zero-paired CB, our payload in a custom CD, and a modified SMC image.
A glitch being unreliable by nature, we use a modified SMC image that reboots infinitely (ie stock images reboot 5 times and then go RROD) until the console has booted properly.
In most cases, the glitch succeeds in less than 30 seconds from power on that way.

Details for the slim hack
=========================

The bootloader we glitch is CB_A, so we can run the CB_B we want.

On slims, we weren't able to find a motherboard track for CPU_PLL_BYPASS.
Our first idea was to remove the 27Mhz master 360 crystal and generate our own clock instead but it was a difficult modification and it didn't yield good results.
We then looked for other ways to slow the CPU clock down and found that the HANA chip had configurable PLL registers for the 100Mhz clock that feeds CPU and GPU differential pairs.
Apparently those registers are written by the SMC through an I2C bus.
I2C bus can be freely accessed, it's even available on a header (J2C3).
So the HANA chip will now become our weapon of choice to slow the CPU down (sorry tmbinc, you can't always be right, it isn't boring and it does sit on an interesting bus

So it goes like that:
- We send an i2c command to the HANA to slow down the CPU at POST code D8 .
- We wait for POST DA start (POST DA is the memcmp between stored hash and image hash), and start a counter.
- When that counter has reached a precise value, we send a 20ns pulse on CPU_RESET.
- We wait some time and then we send an i2c command to the HANA to restore regular CPU clock.
- The cpu speed goes back to normal, and with a bit of luck, instead of getting POST error F2, the boot process continues and CB_A runs our custom CB_B.

When CB_B starts, DRAM isn't initialised so we chose to only apply a few patches to it so that it can run any CD, the patches are:
- Always activate zero-paired mode, so that we can use a modified SMC image.
- Don't decrypt CD, instead expect a plaintext CD in NAND.
- Don't stop the boot process if CD hash isn't good.

CB_B is RC4 crypted, the key comes from the CPU key, so how do we patch CB_B without knowing the CPU key?
RC4 is basically:
crypted = plaintext xor pseudo-random-keystream
So if we know plaintext and crypted, we can get the keystream, and with the keystream, we can encrypt our own code. It goes like that:
guessed-pseudo-random-keystream = crypted xor plaintext
new-crypted = guessed-pseudo-random-keystream xor plaintext-patch
You could think there's a chicken and egg problem, how did we get plaintext in the first place?
Easy: we had plaintext CBs from fat consoles, and we thought the first few bytes of code would be the same as the new CB_B, so we could encrypt a tiny piece of code to dump the CPU key and decrypt CB_B!

The NAND contains CB_A, a patched CB_B, our payload in a custom plaintext CD, and a modified SMC image.
The SMC image is modified to have infinite reboot, and to prevent it from periodically sending I2C commands while we send ours.

Now, maybe you haven't realised yet, but CB_A contains no checks on revocation fuses, so it's an unpatchable hack !

Caveats
=======

Nothing is ever perfect, so there are a few caveats to that hack:
- Even in the glitch we found is pretty reliable (25% success rate per try on average), it can take up to a few minutes to boot to unsigned code.
- That success rate seems to depend on something like the hash of the modified bootloader we want to run (CD for fats and CB_B for slims).
- It requires precise and fast hardware to be able to send the reset pulse.

Our current implementation
==========================

We used a Xilinx CoolRunner II CPLD (xc2c64a) board, because it's fast, precise, updatable, cheap and can work with 2 different voltage levels at the same time.
We use the 48Mhz standby clock from the 360 for the glitch counter. For the slim hack, the counter even runs at 96Mhz (incremented on rising and falling edges of clock)
The cpld code is written in VHDL.
We need it to be aware of the current POST code, our first implementations used the whole 8 bits POST port for this, but we are now able to detect the changes of only 1 POST bit, making wiring easier.

Conclusion
==========

We tried not to include any MS copyrighted code in the released hack tools.
The purpose of this hack is to run Xell and other free software, I (GliGli) did NOT do it to promote piracy or anything related, I just want to be able to do whatever I want with the hardware I bought, including running my own native code on it.

Thursday, August 25, 2011

DMX just proved, "Groundhog Day" is more than a movie -- it's a lifestyle for scofflaws.

Law enforcement tells TMZ ... the rapper was arrested again, after being pulled over last night in Arizona for driving 102 mph in a 65 zone. And for good measure, Mr. X was driving on a suspended license ... so cops arrested him.

He was booked for speeding, reckless driving, and the suspended license -- and has since been released on bond.

FYI -- DMX has now been busted 10 times in Maricopa County, AZ. Back in 2008,Maricopa County Sheriff Joe Arpaio famously made the rapper -- along with other Tent City Jail inmates -- sport a pink jumpsuit .

Wednesday, August 24, 2011

Inc.'s ailing chief executive Steve Jobs is officially stepping down from the helm of the company, an historic shift that hands the reins to chief operating officer Tim Cook.

The company said Mr. Jobs submitted his resignation to the board of directors on Wednesday and "strongly recommended" that the board name Mr. Cook as his successor. Mr. Jobs has been elected chairman of the board and Mr. Cook will join the board, effective immediately, the company said.

"The Board has complete confidence that Tim is the right person to be our next CEO," said Art Levinson, chairman of Genentech and Apple board member, in a statement. He added that Mr. Jobs will "continue to serve Apple with his unique insights, creativity and inspiration."

I have never seen this bird before in my life I live in North Carolina so maybe that should help ID it , I was in my house with my HX9V in my hand & just happened to look out the backdoor & I seen this crazy looking bird in my neighbor's yard so I ran out the side door & recorded it before it flew away, didn't have time to snap any pictures but I did take some screencaps out of the video .

Monday, August 22, 2011

Lil Wayne was rushed to the hospital after he fell on his skateboard at a skatepark in St. Louis & ended up needing 9 stitches over his left eye , the fall that put him in the hospital isn't shown in this video hopefully it will hit the internet soon.

"Sony will launch its next generation home console when developers are unable to improve the games they make, a senior executive at the company has said.

When that happens, Sony will have to "seriously consider" launching the PlayStation 4, worldwide studios boss Shuhei Yoshida told Eurogamer.

"Looking at the platform cycle, when the platform becomes something game developers are not able to improve their creations with, that's the time we have to really seriously consider shifting to the next generation," Yoshida said.

While Microsoft is rumoured to be preparing to launch its new Xbox in 2013, we've heard little about Sony's next home console.

Sony has insisted its focus is on the PS3, which recently enjoyed a price cut, and the PS Vita, due out in Europe early next year."

Friday, August 19, 2011

"The next generation iPad is expected to feature a high resolution display - 2048 by 1536 compared with 1024 by 768 in the iPad 2 - and Apple's suppliers have already shipped small quantities of components for the sampling of the iPad 3. Suppliers said Apple has placed orders for a 9.7-inch screen device."